Crypto Payment Security: How to Protect Your Business from Fraud

Jun 4, 2026 · 8 min read

Accepting crypto payments is not risk-free. Underpaid invoices, webhook spoofing, address reuse, and double-spend attempts are real threats. This guide covers all of them.

Crypto payments are irreversible, which protects you from chargeback fraud. But that irreversibility creates different risks: if you ship goods before a payment fully confirms, you may face a loss. This guide covers the key security considerations for crypto payment acceptance in 2026.

Wait for Sufficient Confirmations

A transaction appearing in the mempool is NOT the same as confirmed. Never fulfill orders on a 0-confirmation transaction — it can be double-spent. Wait for blockchain confirmations before fulfilling. Recommended minimums: USDT TRC20: 20 confirmations (~1 min), Bitcoin: 1–3 confirmations (~10–30 min for high-value), Ethereum: 12 confirmations (~2.5 min), Solana: effectively final after slot inclusion.

Always Verify Webhook Signatures

Never process a payment notification without verifying the cryptographic signature. An attacker can send a fake webhook to your endpoint claiming a payment was received. Bekena signs every webhook with HMAC-SHA256 using your webhook secret — compute the expected signature and compare before taking any action.

javascript

// NEVER do this: app.post("/webhook", (req, res) => { const { invoiceId, status } = req.body; // Dangerous! No verification! if (status === "confirmed") fulfillOrder(invoiceId); }); // ALWAYS do this: app.post("/webhook", express.raw({type: "application/json"}), (req, res) => { const sig = req.headers["x-bekena-signature"]; const expected = crypto.createHmac("sha256", WEBHOOK_SECRET) .update(req.body).digest("hex"); if (sig !== expected) return res.status(401).end(); const { invoiceId, status } = JSON.parse(req.body); if (status === "confirmed") fulfillOrder(invoiceId); });

Handle Underpaid Invoices Correctly

If a customer sends less than the invoiced amount (common due to rounding or wallet fee deductions), you receive a `payment.underpaid` webhook. Never auto-fulfill an underpaid invoice. Either require the customer to top up the difference, or hold the order until you manually decide how to handle it.

Idempotent Webhook Processing

Bekena may deliver the same webhook event multiple times due to network retries. If your handler is not idempotent, you could fulfill the same order twice. Always check if an invoiceId has already been processed before taking action.

Address Reuse and Privacy

Bekena generates a unique address per invoice — never reuse addresses across invoices. Address reuse allows payment correlation (anyone can see all transactions to that address on the public blockchain) and creates accounting ambiguity. Always use fresh invoices, even for repeat customers.

API Key Management

Your API key is a secret. Store it as an environment variable — never in source code, config files committed to version control, or client-side JavaScript. Use separate API keys for sandbox and production. If a key is compromised, rotate it immediately in your Bekena dashboard.

Invoice Expiry and Expired Payment Handling

Invoices expire after a set window (default 1 hour). If a customer pays an expired invoice — which can happen if they delay — the payment still arrives on-chain. Bekena will notify you with a `payment.expired_received` event. Have a process to handle these cases: typically either manually credit the customer or issue a refund.

✓Never fulfill on 0-confirmation transactions
✓Always verify HMAC-SHA256 webhook signatures
✓Make webhook handlers idempotent
✓Never fulfill underpaid invoices automatically
✓Store API keys in environment variables only
✓Generate new invoice address per transaction (never reuse)
✓Have a process for expired invoice payments

Note: Most crypto payment security issues stem from missing webhook verification or processing unconfirmed transactions. Implement both correctly and you eliminate the vast majority of risk.

Ready to accept crypto payments?